Acra v0.95 releases: database protection suite

by do son · Published · Updated

What is Acra

Acra helps you easily secure your databases in distributed, microservice-rich environments. It allows you to selectively encrypt sensitive records with strong multi-layer cryptography, detect potential intrusions and SQL injections and cryptographically compartmentalize data stored in large sharded schemes. Acra’s security model guarantees that if your database or your application get compromised, they will not leak sensitive data or decryption keys.

Acra gives you tools for encrypting the data on the application’s side into a special cryptographic container, storing it in the database, and then decrypt it in a secure compartmented area (separate virtual machine/container). The cryptographic design ensures that no secret (password, key, anything) leaked from the application or database will be sufficient for decryption of the protected data chunks that originate from it.

Acra was built with specific user experiences in mind:

  • quick and easy integration of security instrumentation;
  • cryptographic protection of data in the threat model where all the other parts of the infrastructure could be compromised, but as long as AcraServer isn’t compromised, the data is safe;
  • proper abstraction of all cryptographic processes: you’re safe from the risk of selecting the wrong key length or algorithm padding;
  • secure default settings to get you going;
  • intrusion detection to let you know early that something wrong is going on;
  • high degree of configurability to create the perfect balance between the extra security features and performance;
  • automation/ops-friendly: most of Acra’s features were built to be easily configured/automated using a configuration automation environment.
  • limited attack surface: to compromise an Acra-powered app, an attacker will need to compromise a separate compartmented server, AcraServer – more specifically – its key storage and database;
  • easy to try: you can experience the full might of Acra without committing to its installation using Docker containers.

Acra is a continuously developing security tool. And as any proper security tool, it requires enormous human efforts for validation of the methods, code, and finding possible infrastructural weaknesses. Although we do run Acra in production in several instances, we’re constantly enhancing and improving it as we go. This is done to ensure that the provided security benefits are not rendered useless through implementation problems or increased complexity.

Cryptography

Acra relies on our cryptographic library Themis, which implements high-level cryptosystems based on the best available open-source implementations of the most reliable ciphers. Acra does not contain any self-made cryptographic primitives or obscure ciphers. Instead, to deliver its unique guarantees, Acra relies on the combination of well-known ciphers and smart key management scheme.

How does Acra work?

After successfully deploying and integrating Acra into your application, follow the 4 steps below:

  • Your app talks to AcraConnector, local daemon, via PostgreSQL/MySQL driver. AcraConnector emulates your normal PostgreSQL/MySQL database, forwards all requests to AcraServer over a secure channel, and expects a plaintext output back.
  • Then AcraConnector forwards it over the initial database connection to the application. It is connected to AcraServer via Secure Session or TLS, which ensures that the plaintext goes over a protected channel. It is highly desirable to run AcraConnector via a separate user to compartmentalize it from the client-facing code.
  • AcraServer is the core entity that provides decryption services for all the encrypted envelopes that come from the database and then re-packs the database answers for the application. AcraCensor is a part of AcraServer that allows customizing the firewall rules for all the requests coming to the MySQL database.
  • To write the protected data to the database, you can use AcraWriter library, which generates AcraStructs and helps you integrate it as a type into your ORM or database management code. You will need Acra’s public key to do that. AcraStructs generated by AcraWriter are not readable by it — only the server has the right keys to decrypt it.
  • You can connect to both AcraConnector and the database directly when you don’t need encrypted reads/writes. However, increased performance might cost you some design elegance (which is sometimes perfectly fine when it’s a conscious decision).

Acra also has additional smaller components like AcraCensor firewall and a lightweight HTTP web server for managing AcraServer’s certain configuration options AcraWebConfig. To better understand the architecture and data flow, please refer to Architecture and data flow section in the official documentation.

The typical Acra workflow looks like this:

  • The app encrypts some data using AcraWriter, generating AcraStruct with AcraServer public key and updates the database.
  • The app sends SQL request through AcraConnector, which forwards it to AcraServer.
  • AcraServer passes each query through AcraCensor (currently only works with MySQL databases), which can be configured to blacklist or whitelist some queries. AcraServer forwards the allowed queries to the database.
  • Upon receiving the answer, AcraServer tries to detect the encrypted envelopes (AcraStructs). If it succeeds, AcraServer decrypts payload and replaces the AcraStructs with plaintext answer, which is then returned to AcraConnector over a secure channel.
  • AcraConnector then provides an answer to the application, as if no complex security tool was ever working within the system.

Changelog v0.95

  • Core:

    • AcraServer:

      • Changed default tokenization settings: consistent_tokenization is now used by default for tokenization #614
      • Improved processing of packets related to transparent encryption/tokenization #628, #630, #637
      • Improved searchable encryption:
        • Added support of NotEqual/Like/ILike operators #605 , #606, #607, #609
        • Improved handling of the response_on_fail option for error cases #612
        • Added the response_on_fail option in encryptor config #618
      • Improved SQL parser:
        • Added support of non-aliased columns with aliased queries #602
        • Improved support of limit/offset for PostgreSQL #603
        • Added support of RETURNING statement for INSERT/UPDATE/DELETE #610
        • Added support of RESET packets for MySQL binary protocol #611
        • Added support of schema() functions, thanks to the new contributor @jercheng #634
      • Added new and deprecated some of existing prometheus metrics #632
        • Added the acra_decryptions_total with labels: {"status": [ "success", "fail"], "type": [ "acrastruct", "acrablock", "acrablock_searchable", "acrastruct_searchable"]}
        • Added the acra_encryptions_total with labels: {"status": [ "success", "fail"], "type": [ "acrastruct", "acrablock", "acrablock_searchable", "acrastruct_searchable"]]}
        • Added the acra_tokenizations_total with labels: {"status": [ "success", "fail"], "token_type": "{token_type}"}
        • Added the acra_detokenizations_total with labels: {"status": [ "success", "fail"], "token_type": "{token_type}"}
        • Deprecated the acra_acrastruct_decryptions_total
        • Deprecated the acra_api_encryptions_total
      • Removed building and testing Acra binaries for old golang versions: now Acra supports only the latest version of golang #624

    • AcraTranslator:

      • Changed default HTTP API settings: --http_api_enable is now true by default starting from 0.96.0 #627

    • AcraServer, AcraTranslator, AcraKeys:

      • Improved support of tls_ocsp_*/tls_crl_* options if the options tls_ocsp_[client|database]_*/tls_crl_[client|database]_* were not specified #617

    • AcraRollback, AcraRotate:

      • Added support of TLS configuration options for connections to the database #623
      • Improved parsing of connection strings with complicated usernames #642, #643

    • AcraTokens:

      • Added support of TLS configuration options for Redis storage #619

    • AcraKeys:

      • acra-keys destroy command supports destroying poison record symmetric keys and keypairs, searchable and storage keypairs and symmetric keys #625
      • acra-keys destroy command supports destroying rotated key with the new flag --index=<index:int> #641. You can find examples on the documentation page
      • acra-keys import/acra-keys export supports keystore v1 #629
      • acra-keys list lists the rotated keys for keystore v1 & v2 with the new flag --rotated-keys #636. The formats of listed keys are updated. You can find examples on the documentation page/

Install && Use

Copyright 2015 Cossack Labs Limited

Tags: Acra